CVE-2016-3973 Information disclosure in n/a

What is CVE-2016-3973?

CVE-2016-3973 is a medium-severity vulnerability in Sap Netweaver Application Server Java, published on 7 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#, pressing "Add users", and doing a search, aka SAP Security Note 2255990.

Weakness: CWE-200

Which versions are affected by CVE-2016-3973?

It affects 1 product.

Products include Sap Netweaver Application Server Java.

How do I fix CVE-2016-3973?

No fix has been published for CVE-2016-3973 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-3973 being exploited?

There is no known exploitation of CVE-2016-3973 in the wild and no public exploit code.

Other vulnerabilities in Sap Netweaver Application Server Java

• CVE-2020-6287 SAP NetWeaver Missing Authentication for Critical Function Exploited Critical 10.0
• CVE-2010-5326 SAP NetWeaver Remote Code Execution Exploited Critical 10.0
• CVE-2016-2386 SAP NetWeaver SQL Injection Exploited Critical 9.8
• CVE-2017-12637 SAP NetWeaver Directory Traversal Exploited High 7.5
• CVE-2016-3976 SAP NetWeaver Directory Traversal Exploited High 7.5

All Sap Netweaver Application Server Java vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2gm-j7pw-mh9p.